yt-dlp's maintainer says Bun is now 'fully vibe-coded'. Support is officially deprecated.

yt-dlp’s maintainer bashonly opened issue #16766 on May 20 and formally deprecated Bun as a JavaScript runtime. The supported version window is now Bun 1.2.11 through 1.3.14, down from a previous floor of 1.0.31. Older versions silently ignored yt-dlp’s lockfile, which the maintainer calls a security issue. Newer versions get blamed on Bun’s own development trajectory.

bashonly is direct about what changed. “We are alarmed and disappointed to see that its development seems to have taken a turn towards being fully vibe-coded,” the announcement reads. yt-dlp downloads more than a million times a day from npm and the same again from PyPI, so the project’s runtime support matrix is load-bearing for a meaningful slice of the open-source ecosystem.

Why this hits Bun harder than it looks

The trigger is timing. Jarred Sumner’s team merged Bun’s million-line Rust rewrite to mainline on May 15, a six-day Zig-to-Rust port that landed with 99.8% test pass rate and roughly 13,000 unsafe Rust blocks. Sumner himself flagged the 0.2% test gap as the risk surface. yt-dlp’s response was to publish a list of specific Bun versions it will support and a public dissent on how the runtime is being built.

That carries weight because “vibe-coding” has a defined meaning in 2026 vernacular: writing code mostly by prompting an LLM and accepting what comes back. It’s the same word Mitchell Hashimoto used when he pulled Ghostty off GitHub over CI instability, and it’s the same accusation that has stuck to several recent npm supply-chain incidents. When a downstream maintainer of yt-dlp’s scale uses it about an upstream runtime, it isn’t a stylistic complaint. It’s a statement that the maintainer no longer trusts Bun’s quality bar.

A few mechanics matter.

• The version window is narrow on purpose. Bun 1.0.31 through 1.2.10 was excluded for the lockfile bug. 1.3.15 and later get the deprecation framing. That leaves four point releases yt-dlp will actively support, and anything outside the band is on the user.
• bashonly is not pulling Bun today. The post explicitly says “we reserve the right to completely drop support for Bun should it at any point become too burdensome to maintain.” That’s a hedge with intent. Today’s deprecation is the warning shot; the next compatibility break decides whether Bun stays in the matrix at all.
• The pinned comment gates the discussion. bashonly asked commenters to consider whether they actually use Bun with yt-dlp before posting, which read as a pre-emptive moderation choice. Issue threads on yt-dlp’s tracker draw an outsized crowd, and this one had the bait of an upstream-vs-downstream fight built in.

What yt-dlp is signaling to other projects

The wider message is that downstream maintainers are now willing to publicly grade upstream development practices, not just upstream APIs. Bun’s Rust rewrite shipped fast and behaved mostly right, but the percentage of contribution attributed to LLM-driven generation has been visible in the project’s PR history for months, and yt-dlp’s note suggests other downstreams have been watching the same pattern.

That’s a new lever. Library and tool maintainers don’t get to dictate how upstream runtimes are built, but they do get to decide which versions they certify against. A deprecation note from a project as widely consumed as yt-dlp creates a visible cost for upstream development choices that previously stayed inside the project’s own discussions. Bun’s response will be the actual story to watch: a defensive doubling down on the rewrite cadence reads one way, a posted quality plan reads another.

What this means for you

If you use Bun to run yt-dlp, pin to a version in the 1.2.11 to 1.3.14 range now. Anything older fails on the lockfile vulnerability bashonly flagged; anything newer is officially unsupported. Node.js and Deno remain the runtimes yt-dlp recommends.

If you maintain a tool that consumes Bun, take this as a coordination signal. yt-dlp just published the format for a credible public deprecation: name the version window, name the upstream concern, hedge on full removal. Whether you agree with the “vibe-coded” framing or not, that’s the template projects will copy if Bun’s quality bar slips. Sumner’s team built a runtime fast enough to attract real downstream usage. Holding it requires the boring part of software, which is being the kind of upstream that downstreams want to certify against.